tldrdailynews.com logo
Tag

Bug Bounty

All articles tagged with #bug bounty

Apple Tightens Bug-Bounty Submissions After AI-Generated Flood
technology21 days ago

Apple Tightens Bug-Bounty Submissions After AI-Generated Flood

Apple has limited the number of open bug-bounty submissions after a surge of AI-generated, low-quality reports clogs its review system. A security firm using ChatGPT surfaced dozens of macOS bugs but was limited by Apple’s caps, though researchers can request higher limits for critical issues. While AI helps parse submissions, Apple maintains large rewards for real exploits, with prizes up to $2 million and potential bonuses over $5 million; the company notes AI has both aided discovery and auditing of reports.

via MacRumors|
#ai#apple#bug-bounty
Apple tightens bug-report flood as AI-generated findings surge
technology21 days ago

Apple tightens bug-report flood as AI-generated findings surge

Apple has capped the number of open vulnerability reports through its internal security portal and instituted a 30‑day cooldown to curb a surge of AI-generated submissions, part of a broader move to accelerate security updates. Researchers can request higher quotas for critical reports; the policy follows industry trends and high‑profile AI-assisted findings, including Calif.io’s macOS kernel exploit work, with Apple engaging affected researchers like Bynario and noting ongoing bug-bounty adjustments across the sector.

via 9to5Mac|
#ai-generated-reports#apple#bug-bounty
Six-figure bounty awarded for Linux KVM guest-to-host escape flaws
security1 month ago

Six-figure bounty awarded for Linux KVM guest-to-host escape flaws

Google paid $250,000 for Januscape (CVE-2026-53359), a use-after-free flaw in Linux KVM's shadow MMU that can let a malicious guest VM break out and gain root on the host; a separate flaw, GhostLock (CVE-2026-43499), lets limited users escalate to root via futex priority-inheritance. Patches are in the Linux kernel, and users should update to mitigate the risk.

via Ars Technica|
#bug-bounty#guest-vm-escape#kvm
AMD's bounty controversy: researcher denied reward as updater flaw patched after 124 days
technology2 months ago

AMD's bounty controversy: researcher denied reward as updater flaw patched after 124 days

Security researcher MrBruh disclosed a remote-code-execution flaw in AMD's auto-updater; AMD initially dismissed it as out of scope, delayed a bounty for 124 days, and then changed rules about disclosure. The vulnerability could enable MITM via plain HTTP links; AMD patched Ryzen Master, µProf, and Management Console (CVE-2026-40677). AMD now says updates use HTTPS and have signature verification, but the researcher notes the check is weak (CRC32) and a redirection bug could affect self-updating; users should manually install the latest versions from AMD’s site.

via TechSpot|
#amd#bug-bounty#cybersecurity
AI-Fueled Bug Hunt Redraws the Security Patch Landscape
security3 months ago

AI-Fueled Bug Hunt Redraws the Security Patch Landscape

AI agents are increasingly autonomously finding software flaws and crafting exploits, upending bug-bounty economics as researchers log far more discoveries and attackers speed up development. Major programs are trimming or shifting payouts (Curl’s bounty ended; Google adjusted Chrome/Android rewards) and experts warn that faster zero-days and compressed disclosure windows could pressure quicker patches. The trend, including industry calls for structural defenses and architecture changes, suggests a future where human-led bug hunting remains essential but must be complemented by better-infrastructure that makes many bugs irrelevant.

via WIRED|
#ai#bug-bounty#cybersecurity
Google boosts Android/Chrome bug-bounty rewards to as high as $1.5M
technology3 months ago

Google boosts Android/Chrome bug-bounty rewards to as high as $1.5M

Google overhauls its Android and Chrome vulnerability rewards programs, elevating top Android payouts to $1.5 million for zero-click full-chain exploits on the Pixel Titan M2 (with up to $750,000 for non-persistent variants) and offering up to $250,000 for Chrome full-chain exploits plus a $250,128 bonus for MiraclePtr-protected memory allocations; the changes push for concise bug proofs instead of lengthy analyses and narrow Android focus to Linux kernel vulnerabilities in Google components unless researchers demonstrate device exploitability. The revamp follows a record 2025 with $17.1 million paid to 747 researchers, bringing total payouts since 2010 over $81.6 million, and 2026 totals are expected to rise despite some reductions.

via BleepingComputer|
#android#bug-bounty#chrome
GitHub patches critical AI-discovered RCE in under six hours
technology3 months ago

GitHub patches critical AI-discovered RCE in under six hours

Wiz Research used AI to uncover a critical remote-code-execution vulnerability in GitHub’s internal git infrastructure. GitHub’s security team reproduced the issue within 40 minutes, developed a fix, and deployed it to github.com and GitHub Enterprise Server within about six hours total. No exploitation was found. The flaw was described as remarkably easy to exploit, highlighting the importance of rapid response, and it follows recent outages and reliability concerns at GitHub.

via The Verge|
#ai#bug-bounty#github
DJI Shells Out $30K for Romo Hack Discovery, Promises Faster Security Upgrades
technology5 months ago

DJI Shells Out $30K for Romo Hack Discovery, Promises Faster Security Upgrades

DJI will pay security researcher Sammy Azdoufal $30,000 for a discovery related to vulnerabilities in the Romo robot vacuum network, including a fix for a PIN-free video viewing issue. The company says it has already addressed the vulnerability and will roll out further upgrades within a month, while continuing security testing, third‑party audits, and new ways for researchers to collaborate.

via The Verge|
#bug-bounty#dji#robovac
AI Slop Sinks cURL Bug Bounties, Stenberg Says
technology7 months ago

AI Slop Sinks cURL Bug Bounties, Stenberg Says

Daniel Stenberg, lead developer of cURL, is ending the project's bug bounty program at the end of January due to a flood of low-quality AI-assisted submissions he dubs "AI slop." While AI can aid bug discovery, the volume and quality of reports have overwhelmed maintainers, prompting the move even as genuine issues are still welcome under strict AI usage rules.

via The New Stack|
#ai#bug-bounty#curl
Curl ends bug-bounty program as AI-generated noise overwhelms maintainers
technology7 months ago

Curl ends bug-bounty program as AI-generated noise overwhelms maintainers

Open-source tool curl is scrapping its vulnerability-bounty program after a surge of low-quality, AI-generated submissions, with founder Daniel Stenberg saying the team needs to protect their mental health; the move, effective at the end of the month, aims to stop the AI “slop” from flooding reports and distracting from real issues, though critics fear it reduces essential security disclosures.

via Ars Technica|
#ai-generated-reports#bug-bounty#curl